vac-weekly-2025-07-14

Updated the weekly for this week Added SEC update for the week of 2025-07-07
2026-01-07 23:04:01 -05:00 · 2025-07-16 19:12:42 +02:00
parent b1109b4922
commit e425378a28
2 changed files with 247 additions and 1 deletions
--- a/content/updates/2025-07-07.md
+++ b/content/updates/2025-07-07.md
@@ -278,7 +278,21 @@ draft: false
    - Met with Hanno about the plan for next RFCs for this quarter, among the updates, we will also start with qaku as the first RFC to be written by our team for apps built on top of Waku.

 ### vac:sec:
-
+- `ift:2025q2-signatory-registry-implementation:signatory-data-verification`
+    - Added verification data from signing accounts
+- `ift:2025q2-signatory-registry-implementation:signatory-vault-deployment`
+    - Added verified signatory data into the secure vault
+- `ift:2025q2-cicd-security-review:status-design-reviews`
+    - Completed security requirements review for Status wallet and desktop (issue#692) (GitHub issue remains open)
+    - Posted review comments and held discussions for Status security design (issue#692)
+    - Worked on defining scope, requirements, and pre-audit evaluation for Status external audit request
+- `ift:2025q2-vulma-and-ir:incidents`
+    - Completed Keycard incidents secrets rotations and related IR investigations
+    - Finalized secrets and credentials rotations
+- `ift:2025q2-security-automation:wallet-data-automatic-updates`
+    - Validated concept for n8n workflow
+- `ift:2025q2-iam-operations:remove-unnecessary-users`
+    - Completed extracting user details for user management (GitHub, Discord, Google)
 ### vac:nes:
 - `Q2 last plans`
    - Reviewed [Solana's doc](https://www.notion.so/Adapting-Solana-s-architecture-to-NSSA-21e8f96fb65c805f9daccf396dffa408?source=copy_link ) and created a [small doc](https://www.notion.so/Solana-s-overall-review-2258f96fb65c807b8a79e91d292fe744?source=copy_link) with summary and some security checks.
--- a/content/updates/2025-07-14.md
+++ b/content/updates/2025-07-14.md
@@ -0,0 +1,232 @@
+---
+title: 2025-07-14 Vac weekly
+tags:
+  - vac-updates
+date: 2025-07-14
+lastmod: 2025-07-14
+draft: false
+---
+
+## Vac 2025/07/14
+
+### highlights
+- QA: Keycard first tests executed
+- QA: Progress on status mobile app testing using appium
+- QA: Waku sync testing almost done
+- QA: Improvements in execution and speed for status desktop automated tests
+- DST: Analyzing potential reproducible issue with waku Store protocol
+### vac:p2p:
+- `ift:2025q1-gossipsub-perf-improvements`
+    - Looked into Ethereum consensus, and P2P interface specs
+    - Looked in detail into DAS (and possible approaches and discussions on dissemination and sampling)	
+		- catching up different discussions and proposals on dissemination and sampling
+- `vac:p2p:ift:2025q2-nimlibp2p-maintenance:maintenance`
+    - Started to modify nim-quic to use BoringSSL/AWS-LC (they're the same API wise, still not sure which one to use)
+    - Currently it uses cmake and this is a big problem as it still introduces an additional dependency and nimbus is actively trying to avoid to use cmake
+    - I'm trying to get it to compile without cmake, just with {.compile.} pragmas
+- `vac:p2p:ift:2025q2-nimlibp2p-maintenance:maintenance`
+    - continued working on performance improvements issue: [nim-libp2p#1484](https://github.com/vacp2p/nim-libp2p/pull/1484)
+        - current performance improvement is approximately 55.5%
+        - chore: utilizing newSeqUninitialized [nim-libp2p#1510](https://github.com/vacp2p/nim-libp2p/pull/1510)
+        - chore: add template newSeqUninit [nim-libp2p#1518](https://github.com/vacp2p/nim-libp2p/pull/1518)
+        - perf(noise): encryptWithAd improvement [nim-libp2p#1520](https://github.com/vacp2p/nim-libp2p/pull/1520)
+        - refactor(yamux): memory usage improvements [nim-libp2p#1504](https://github.com/vacp2p/nim-libp2p/pull/1504) 
+            - one test fails
+    - chore: removing unused type StreamSeq [nim-libp2p#1507](https://github.com/vacp2p/nim-libp2p/pull/1507) 
+- `vac:p2p:ift:2025q2-nimlibp2p-autotls:cert-installation`
+    - Wrapping up cert installation
+    - Dealing with async issues on switch
+- `vac:p2p:ift:2025q2-nimlibp2p-kad-dht
+   - Primed my brain reading the [original research paper](https://cs.nyu.edu/~anirudh/CSCI-GA.2620-001/papers/kademlia.pdf)
+   - perused the [spec](https://github.com/libp2p/specs/blob/master/kad-dht/README.md)
+   - Documented initial code perusal with a [PR](https://github.com/vacp2p/nim-libp2p/pull/1523)
+- `misc/admin`
+    - 1 CC 2d OoO (sick leave)
+
+### vac:tke:
+- `admin`
+  - 6 CC days off
+- `vac:tke:ift:logos-token:redemption-window`
+  - finalized modeling and simulating the LOGOS/BU arbitrage problem
+  - simulating certain scenarios to answer core questions
+- `vac:tke:nomos:stress-test::review-block-rewards`
+  - addressed questions from Nomos team about spec
+- `vac:tke:nomos:stress-test::blend-validator-split`
+  - couldn't find a rationale to split the rewards to validators and blend
+- `vac:tke:status:karma-incentives`
+  - looking in to uUSD, Steakhouse vaults and Morpho
+  - reviewing Cyp's docs and progressing with Karma modeling
+
+### vac:qa:
+- `waku:2025q3-interop-testing:jswaku-filter-hardening`
+  - Added 3 more reliability tests for [network conditions](https://github.com/waku-org/js-waku/pull/2450)
+  - Got some feedback on the [1st PR](https://github.com/waku-org/js-waku/pull/2444)
+- `waku:2025q3-interop-testing:maintenance`
+  - Adjusted Waku interop tests to latest [nwaku changes and fixes](https://github.com/waku-org/waku-interop-tests/pull/128)
+- `status:2025q3-status-go-functional-testing:reliability-communities`
+  - Tried to create tests for this task but it's not ready yet
+  - Switched to group chat actions functional tests
+- `status:2025q3-status-go-functional-testing:framework-improvements`
+  - Fixed the [reliability failures](https://github.com/status-im/status-go/actions/runs/16075568798)
+- `keycard:2025q3-keycard-testing:shell-tests`
+  - Wrote [test plan](https://www.notion.so/Keycard-Shell-Test-Plan-2298f96fb65c8051b7f6edd281ad3372?source=copy_link) for integration tests
+  - Updated Shell's firmware to v0.9.20
+  - Logged [test results](https://www.notion.so/Keycard-Shell-Test-Results-22b8f96fb65c80faa06fcc195373624b?source=copy_link); shared updates [here](https://discord.com/channels/1366754869561790474/1389137702183768074)
+- `waku:2025q3-interop-testing:wakucannary`
+  - Attempted communication using the tool (on hold due to focus on store sync)
+- `waku:2025q2-waku-sync-testing:Integration-test`
+  - Added and investigated new tests; some are failing
+  - Reformed tests to match protocol criteria
+  - First [PR 125](https://github.com/waku-org/waku-interop-tests/pull/125) ready for review
+  - Added second [PR 129](https://github.com/waku-org/waku-interop-tests/pull/129) with corner case tests
+- `vac:2025q3-nim-libp2p-testing:gossipsub-completion`
+  - [test(gossipsub): behavior unit tests 1](https://github.com/vacp2p/nim-libp2p/pull/1501) – merged
+  - [test(gossipsub): behavior unit tests 2](https://github.com/vacp2p/nim-libp2p/pull/1503) – merged
+  - [test(gossipsub): gossipsub unit tests 1](https://github.com/vacp2p/nim-libp2p/pull/1508) – merged
+  - [test(gossipsub): gossipsub unit tests 2](https://github.com/vacp2p/nim-libp2p/pull/1511) – merged
+- `vac:2025q3-nim-libp2p-testing:gossipsub-performance`
+  - Started investigation
+- `status:2025q3-status-qa-desktop:maintenance`
+  - Merged multiple PRs: [18328](https://github.com/status-im/status-desktop/pull/18328), [18317](https://github.com/status-im/status-desktop/pull/18317), [18290](https://github.com/status-im/status-desktop/pull/18290)
+  - Worked on tests in [18259](https://github.com/status-im/status-desktop/pull/18259)
+  - Investigated test mode via [18337](https://github.com/status-im/status-desktop/pull/18337)
+  - Fixed tests for screen issues in [18342](https://github.com/status-im/status-desktop/pull/18342)
+  - Opened issues: [18315](https://github.com/status-im/status-desktop/issues/18315), [18316](https://github.com/status-im/status-desktop/issues/18316)
+  - Manual testing on Windows
+  - Collaborated with Magnus to set up Squish for mobile
+- `status:2025q3-status-qa-mobile:framework-adjustments`
+  - Investigated iOS automation via Squish and Appium
+    - Squish failed to hook; Appium failed due to simulator crashes
+    - Manual test on LambdaTest worked
+  - Switched to Appium and started a new Android-only framework
+- `admin/misc`
+  - OOO: 5 CC days
+
+### vac:dst:
+- `admin/misc`
+    - 1 CC OOO from Wednesday 9th to Friday 11th
+- `vac:dst:ift:2025q2-dst-research-destination:forum-post`
+    - Add reports to forum and summarize DST activity, closing the task
+- `vac:dst:ift:2025q2-dst-research-destination:public-reports`
+    - Group public reports and closing the task
+- `vac:dst:status:2025q3-status-go-evaluation:*`
+    - Create main document with some results
+        - [Notion Document](https://www.notion.so/Status-backend-chat-protocol-benchmarks-WIP-22a8f96fb65c80b3b49ec05b87edee3c)
+    - Call with some questions with Status
+- `vac:dst:waku:2025q3-waku-evaluation:regression-testing`
+  - Added Memory Usage charts (nim GC and container metrics)
+  - Ran longer running tests to check discv5 over time (still need to analyze)
+  - Handling lightpush request that was pushing to many nodes
+      - Unable to reproduce this. Assume max-connections was higher in previous experiments.
+- `vac:dst:waku:2025q3-waku-evaluation:store-dial-failure`
+  - Able to reproduce the `PEER_DIAL_FAILURE` consistently
+  - [Notes](https://www.notion.so/Experiments-for-nWaku-v36-0-21e8f96fb65c801e9ffcd25cf0d88370?source=copy_link#22d8f96fb65c807a8fe1d7c7496107a2) (section: get_store_nodes pull from all)
+  - Investigated relay node disconnects (Stream Closed / Stream Reset in logs)
+      - [Notes](https://www.notion.so/Experiments-for-nWaku-v36-0-21e8f96fb65c801e9ffcd25cf0d88370?source=copy_link#21f8f96fb65c806fafe3dbf5f8025459) (Section: store issue > store node)
+- `vac:dst:waku:2025q3-dst-tooling:general-tooling`
+  - Minor fix to plotting code
+      - [Github PR](https://github.com/vacp2p/10ksim/pull/76)
+
+### vac:sc:
+- `admin/misc`
+	- CC's were out
+### vac:acz:
+- `ift:2025q3-de-mls-tesnet:consensus-layer`
+    - Continue working on consensus layer implementation on the [branch](https://github.com/vacp2p/de-mls/tree/feat_consensus)
+- `ift:2025q2-zerokit:perfomance-updates-blogpost`
+    - Reviewed blogpost in [PR](https://github.com/vacp2p/vac.dev/pull/170)
+- `ift:2025q3-libp2p-mix-testnet:update-rfc`
+    - Finalized Sections 8.3 to 8.5 ([mix-rev1-continue](https://github.com/vacp2p/rfc-index/tree/mix-rev1-continue)).
+- `ift:2025q3-zerokit:rln-wasm-maintaining`
+  - Continued work on the remaining tasks related to the Node.js test case.
+- `ift:2025q3-zerokit:ci-revising`
+  - Addressed the current default enablement of the parallel feature flag in rln, rln-wasm and utils module, resolved macro expansion problem and improved CI runtime [(PR)](https://github.com/vacp2p/zerokit/pull/325)
+  - Removed the non-arkzkey feature, set arkzkey as the default, wrote a script to convert to arkzkey [(PR)](https://github.com/vacp2p/zerokit/pull/326)
+  - Reviewed [PR](https://github.com/vacp2p/zerokit/pull/325)
+- `ift:2025q3-de-mls-tesnet:de-mls-maintaining`
+    - Merge improve the slow CI workflow PR [(Commit)](https://github.com/vacp2p/de-mls/issues/37)
+    - Reviewed [PR](https://github.com/vacp2p/de-mls/pull/42) regrading CI updates
+- `ift:2025q3-rln-status-l2:e2e-prover-testing`
+    - [End to end unit test](https://github.com/vacp2p/status-rln-prover/pull/15) - merged
+    - [End to end benchmark](https://github.com/vacp2p/status-rln-prover/pull/16) - merged
+    - [Epoch service unit test](https://github.com/vacp2p/status-rln-prover/pull/17) - merged	
+    - Prover memory allocation profiling such as [Memory tracking allocator](https://github.com/tobz/tracking-allocator/tree/main) and [LeakTracer allocator](https://github.com/veeso/leaktracer)
+    - Explore / Read about Rust + Metrics: [source 1 Not generic (Prometheus only)](https://romankudryashov.com/blog/2021/11/monitoring-rust-web-application/), [source 2](https://dimitrmo.medium.com/setting-up-metrics-in-rust-and-go-a-comprehensive-guide-13b9684d588c), [source 3 (too Actix centrix](https://medium.com/better-programming/monitoring-a-rust-web-application-using-prometheus-and-grafana-3c75d9435dec)), [source 4 (Not maintained)](https://docs.rs/autometrics/latest/autometrics/ ) [and source 5](https://www.hamzak.xyz/blog-posts/how-to-setup-and-use-metrics-in-rust) -> Use [metrics crate](https://github.com/metrics-rs/metrics)
+    - [Prover + Metrics](https://github.com/vacp2p/status-rln-prover/pull/18/files) - WIP  
+- `ift:2025q3-zerokit:zerokit-maintaining`
+    - [Zeroize 2nd attempt](https://github.com/vacp2p/zerokit/pull/320) - merged
+    - [Doc PR](https://github.com/vacp2p/zerokit/pull/324) - merged
+- `ift:2025q3-zerokit:big-endian-support` 
+    - [Waku + BE endian format](https://github.com/vacp2p/zerokit/pull/318) - updated based on the discussions. 
+    - Discussed the issue of generating commitmentId out of field, now there is a version that waku side is somewhere wrongly converted BE to LE [PR](https://github.com/vacp2p/zerokit/pull/318)
+- `ift:2025q3-de-mls-tesnet:multi-steward-rfc`
+    - Addressed feedbacks on [PR](https://github.com/vacp2p/rfc-index/pull/166)
+    - Had discussion about who can create votin proposal in poc and RFC. 
+- `ift:2025q2-de-mls-tesnet:blogpost-de-mls-over-waku`
+    - Finalized [blogpost](https://github.com/vacp2p/vac.dev/pull/159), only wait for the de-MLS RFC is merged.
+- `ift:2025q3-rln-status-l2:rln-spec-maintain`
+    - Added storage section to the [Status RLN Deployment spec](https://www.notion.so/RLN-Deployment-Spec-WIP-1f98f96fb65c806c8737d94851b4d14d)
+- `acz:t1`
+    - [Review Draft of zkVM selection doc](https://www.notion.so/Draft-of-zkVM-selection-2268f96fb65c805292eae929dde0c2ee#22b8f96fb65c80e8a9f5d3f6d3d0eee3)
+    - Having discussion about q3 tasks basically clarify the commits.
+    - Review [alternative of pedersen commitment doc](https://www.notion.so/zkVM-benchmarks-WIP-22b8f96fb65c805d985cedbab0f7130d#22e8f96fb65c8007b276ea377192b1b8)
+    - Ran [nexus](https://github.com/vacp2p/nescience-zkvm-testing/pull/5) and [risc0](https://github.com/vacp2p/nescience-zkvm-testing/pull/3) tests for Pedersen commitments on a more powerful computer, and [concluded](https://www.notion.so/zkVM-benchmarks-WIP-22b8f96fb65c805d985cedbab0f7130d?source=copy_link#22b8f96fb65c8043a775e440fee5a535) that EC operations are infeasible in zkVMs (even with precompile).
+    - Drafted a [mitigation recommendation](https://www.notion.so/zkVM-benchmarks-WIP-22b8f96fb65c805d985cedbab0f7130d?source=copy_link#22e8f96fb65c8007b276ea377192b1b8) to replace Pedersen commitments for UTXOs with Merkle tree.
+    - Wrote a [simple test]((https://github.com/vacp2p/nescience-zkvm-testing/pull/3)) with precompiling for UTXO-type Merkle tree generation in Risc0.
+    - Began review of Zisk and Ziren (rebrand of zkmips).
+- `admin/misc`
+    - Provided context and feedback regarding Mix project state and task alignment.
+    - Synced briefly with P2P team on branch unification – clarified key differences and proposed isolating protocol logic into Mix Entry/Exit layers.
+    - Assist in planning Acz <-> Nescience tasks for Q3.
+
+
+### vac:rfc:
+- `vac:rfc:nomos:2025q3-rfc-iteration`
+    - Completed open pr reviews - https://github.com/vacp2p/rfc-index/pull/156 , https://github.com/vacp2p/rfc-index/pull/164
+- `vac:rfc:nomos:2025q3-rfc-iteration:mantle-digital-signature`
+    - Continued work on Mantle Digital Signature RFC, should have first draft next week
+-  `vac:rfc:waku:2025q3-rfc-iteration:qaku`
+    - Started reviewed the qaku codebase
+- `vac:rfc:codex:2025q3-rfc-iteration:block-exchange`
+    - First draft of Codex Block Exchange: https://github.com/vacp2p/rfc-index/tree/codex/raw/codex-block-exchange-raw
+### vac:sec:
+- `ift:2025q3-multisig-secondary-interface-deployment:initial-evaluation`
+    - Reviewed Safe CLI
+- `ift:2025q3-wallet-management-policy-revalidation:review-current-documentation`
+    - Reviewed Signatory Add runbook
+    - Reviewed Master Wallet Index documentation
+- `ift:2025q2-signatory-registry-implementation:signatory-vault-deployment`
+    - Added verified signatory data into the secure vault
+    - Updated the master wallet index
+- `ift:2025q3-cicd-security-review:status-design-reviews`
+    - Worked on open items in Status security design review (issue#692)
+    - Continue defining scope, requirements, and pre-audit readiness for Status and Codex external audits
+- `ift:2025q3-vulma-and-ir:incidents`
+    - Begin investigation into the recent SNT phishing attempt; coordinate with stakeholders for evidence gathering and response
+- `ift:2025q3-vulma-and-ir:remediation-tracking`
+    - Continue work on unresolved Dependabot and CodeQL findings; focus on critical repositories and high/medium issues
+- `ift:2025q3-vulma-and-ir:incidents`
+    - Follow up recent SNT phishing attempt; coordinate with stakeholders for evidence gathering and response
+    - Finalize and finish pending work circulate Keycard incident post-mortem documentation
+    - Complete updates to IR process documentation and share with relevant teams
+- `ift:2025q3-vulma-and-ir:remediation-tracking`
+    - Continue work on unresolved Dependabot and CodeQL findings; focus on critical repositories and high/medium issues
+- `admin/misc`
+    - Reviewed the secure treasury Q3 commitments
+    - 1 CC on vacation
+### vac:nes:
+- `vac:nes:2025q3:state-separation-architecture-poc:zkvm`
+    - Continued research on [zkVMs](https://www.notion.so/Draft-of-zkVM-selection-2268f96fb65c805292eae929dde0c2ee). Some of the already analyzed projects in the past did not change.
+    - Worked on zkvm criteria, alternatives, and deep analysis on each of them.
+    - Draw conclusions about R0 zkVM and which one is the best fit for NSSA.
+    - Finished the instruction metering analysis for Risc0 [task](https://www.notion.so/Investigate-if-Risc0-RV32IM-is-friendly-for-gas-metering-and-instruction-counting-2158f96fb65c807d991feba05f68519f).
+    - Started working on the selective privacy proof of concept using risc0 [subtask](https://www.notion.so/Explore-and-analyze-feasibility-of-selective-privacy-using-a-Risc0-based-zkVM-2158f96fb65c81dcb21edf60693f13bd). See draft [here](https://github.com/vacp2p/nescience-zkvm-testing/pull/6) and an explanation of the work in progress [here](https://discord.com/channels/864066763682218004/1389875821250084894/1393416408439853097).
+
+
+- `vac:nes:2025q3:state-separation-architecture-poc:seq-check`
+    - Worked on [PR](https://github.com/vacp2p/nescience-testnet/pull/88) for sequencer. 
+    - Created a [PR](https://github.com/vacp2p/nescience-testnet/pull/89) to solve part of Issue #66.
+    - Created a [PR](https://github.com/vacp2p/nescience-testnet/pull/90) to fix CI.
+    - Started working on adding signature verification for transactions in the sequencer (See task description [here](https://www.notion.so/Transactions-with-valid-signatures-2308f96fb65c8151af65fe4b73d55652?source=copy_link) and draft PR [here](https://github.com/vacp2p/nescience-testnet/pull/91)).
+
+